A procedure sets regular vulnerability assessment of information systems; findings are remediated and reported to the responsible manager; newly published vulnerabilities are tracked continuously and their impact analysed and addressed; and assessment history is kept so recurring findings get protection measures (Standards for Securing Personal Information Articles 4 and 6).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.